Also, any changes to the software run on self-driving cars should be stored in an "escrow" service for at least X months before it is uploaded (preferably by an independent party) to the cars, to allow for sufficient testing.

We don't want to end up in the situation where car manufacturers make quick updates to cover flaws.

If the software is broken, the cars should be grounded, the software should be fixed and tested for at least X hours of driving.